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FIELD OF THE INVENTION 

This invention relates to network management applications that manage network 
devices and specifically to filtering expressions that characterize messages accepted by 
the network management applications. 

BACKGROUND OF THE INVENTION 

Computer networks, to which this invention applies, are systems comprising a 
number of components such as printers, computers, routers and the like, that are con- 
nected to enable communication among the components and sharing of data and re- 
sources. For example, a computer network system may include a server that provides 
shared resources to network^sers, one or more clients that access shared network re- 
sources provided by the server, a physical medium that connects the network computers, 
and shared data and resources. In order for a computer network system to operate effi- 
ciently, a system administrator must constantly monitor and manage each network com- 
ponent. The system administrator generally manages the network by performing the fol- 
lowing management tasks: user administration for creating, maintaining and securing 
user accounts; resource management for implementing and supporting network resources; 
configuration management for planning, expanding, and maintaining configuration; per- 
formance management for monitoring and tracking network activity to maintain and en- 
hance the network's performance; and network maintenance for preventing, detecting and 
solving network problems. To perform these management tasks effectively, the system 
administrator must receive timely and accurate information about the state of each net- 
work component. 

Therefore, the states of network components are constantly monitored by software 
applications known as "producers". Producers generate error messages or alarm mes- 
sages when they detect anomalies, i.e. any condition that is not expected. Examples of 
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producers include a router that generates a "trap", i.e. an error message, whenever it de- 
tects an anomaly in a network device and a poller which is a software application that 
polls the network for data and generates an error or informational message whenever an 
anomaly is founds Messages from the producers are transmitted to a distributor for £ur- 

5 ^ ther transmission to the appropriate network client or consumer. The distributor is a 
software application that queues incoming messages from producers and transmits each 
message to the consumers that request that message. Consumers are software applica- 
tions that display to the system administrator errors or alarms generated by the producers 
and they may also perform various functions for correcting the reported anomaly. An 

10 example of a consumer is a desktop application that displays a network map displaying 
the location of each anomaly. Each consumer may be dedicated to reporting jnd correct- 
ing specific network anomalies. Thus when the distributor distributes a message from the 
producer, it sends the message to only those consumers that requested messages of those 
anomalies. * 

is After the network starts up, each consumer in the network registers with the dis- 

tributor. The registration information from each consumer includes filtering expressions 
that are stored in the distributor's registration list; the filtering expressions are used by the 
distributor to determine which consumer(s) requested the incoming message for each 
message type. The filtering expressions are dynamic and may be changed by the system 

20 administrator or they may be changed when the consumer detects certain error and/or 
anamoly conditions. Currently, the filtering expressions are Boolean statements and/or 
SQL (query) statements which are evaluated by the distributor every time the distributor 
receives an incoming message. Upon evaluating a message, if a filtering expression is 
true, the distributor sends the message to the consumer associated with that filtering ex- 

25 pression. 

Although simple filtering expressions using Boolean or SQL statements are easy 
to develop, complex filtering expressions using these statements are more difficult to de- 
velop. An example of a complex filtering expression is one where the consumer requests 
only a sampling of error messages from a specific device. Moreover, the SQL and Boo- 
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lean expressions must be translated into the programming language of the distributor each 
time they are evaluated, i.e. whenever a new message is received from a producer. Each 
translation consumes processing time and hinders the performance of the distributor. 

- SUMMARY OF THE INVENTION 

5 We have created a system whereby each consumer generates a filtering program 

based on criteria set forth by the system operator during run time. While the network 
system is operating, the system administrator selects the appropriate filtering criteria from 
display screens associated with the respective consumers. Each consumer implements its 
filtering criteria in a filtering program and registers the filtering program with the dis- 

10 tributor. Each consumer may also dynamically alter its filtering program dufmg run time 
when it detects certain error and/or alarm conditions. This allows the consumer to de- 
termine and display the rootcauses of problem(s) being solved on the system and it al- 
lows the consumer to determine when a problem has been rectified. With this arrange- 
ment, the filtering programs may include simple true or false tests or they may include 

is more complex tests that cannot be implemented using simple Boolean or SQL statements. 
This provides an environment in which the system operator can effectively narrow the 
filtering criteria for each consumer and thereby reduce consumer processing of unwanted 
messages. 

Specifically in the preferred embodiment of the invention, the distributor compiles 
20 each filtering program provided by each consumer when the consumer registers with the 
distributor. Unlike Boolean and SQL statements that cannot be translated into the dis- 
tributor's native language and that must be interpreted each time a query is performed on 
an incoming message, the filtering programs are written and compiled in the same high 
level programming language as the distributor. Thereafter, the distributor dynamically 
25 loads the compiled filtering programs before executing the filtering queries. Since the 
distributor does not have to interpret the filtering programs upon receiving each incoming 
message, it processes and distributes the message faster than the prior distributors that 
executed Boolean and SQL statements. 

3 
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BRIEF DESCRIPTION OF THE DRAWINGS 

The above and further advantages of the invention may be better understood by 
referring to the following description in conjunction with the accompanying drawings in 
which like reference numbers indicate identical or functionally similar elements: 
5 Fig. 1 is a diagram of a network management system incorporating the invention; 

Fig. 2 is a schematic diagram of the network management applications and how 
they interact with each other and with the distributor application; 

Fig. 3 illustrates a message from the producer to the distributor; 

Fig. 4-A illustrates filtering expressions in a Boolean statement; 
io Fig. 4-B illustrates filtering expressions in a SQL statement; and 

Fig. 4-C illustrates filtering expressions in a filtering program. 

DETAILED DESCRIPTION OF AN ILLUSTRATIVE EMBODIMENT 

Fig. 1 is a schematic diagram of a distributed network management system that is 
configured to share resources and data in accordance with the present invention. The il- 
ls lustrated system is a combination of four separate local area networks (LAN) 1 01-104 
that are interconnected into a wide area network (WAN) to form a single distributed net- 
work structure. Each LAN 101-104 may include servers and clients that are connected by 
physical media such as cables and network cards in order to share resources such as files 
or applications. A server is a computer that provides shared network resources to net- 
20 work users and a client is a computer that accesses the shared network resources provided 
by the servers. Shared resources in a network may include printers and other pheriphals 
and software applications. The LANs 101-104 are interconnected to communicate with 
each other by routers 1 1 1-1 14. Routers exchange protocol-specific information between 
separate networks, determine the best path for sending data and filter broadcast traffic to 
25 local segments of the network structure. 

In order to effectively manage a distributed network system, the system adminis- 
trator must perform user administration, configuration management, performance man- 
agement and maintenance. Timely and accurate information about the states of each net- 
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work's component is required for the system administrator to perform the necessary net- - 
work management functions- Therefore, the states of these network components are 
consistently monitored by a reporting structure which includes producers which generate 
error and alarm messages and a distributor which transmits these messages to consumers 
5 _ which display the messages to the system operator* 

The illustrative reporting structure 200 shown in Fig. 2 includes three producers 
202-206, a distributor 208, and four consumers 210-216. Producers 202-206 are soft- 
ware applications that constantly check the states of network components and produce 
error and/or alarm messages whenever they detect anomalies. The distributor 208 is a 
10 software application which queues messages from producers 202-206 and transmits them 
to the appropriate network client or consumer 210-216. In the present inventfbn, the dis- 
tributor 208 is developed in a high level programming language such as JAVA. Consum- 
ers 210-216 are software applications that display to the system administrator error or 
alarm messages of network anomalies. 

is In accordance with the present invention, when a producer 202-206 detects an 

anomaly, it generates a message and transmits the message to the distributor 208. The 
message is stored in the distributor's queue 218. Thereafter, the distributor 208 exe- 
cutes filtering programs 220-226 received from the consumers 210-216, respectively, to 
determine which of the consumers are to receive the message. If the test from the fil- 

20 tering expressions in a consumer's filter program is true, the distributor 208 forwards 
the message to that consumer. The consumer then displays the message to the system 
operator and/or takes other action to correct the anomaly as directed by the system op- 
erator. 

After the network starts up, each consumer 210-216 enables the system adminis- 
25 trator to create filtering expressions through its graphical user interface. While the net- 
work system is operating, the system administrator chooses the appropriate filtering cri- 
teria from the consumer's display screen. Each consumer 210-216 implements the filter- 
ing expressions as a filtering program 220-226 and registers the filtering program with 
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the distributor 208. Each consumer may also dynamically alter it's filtering program 
during run time if it detects certain error and/or alarm conditions. This enables the con- 
sumers to determine and display the root causes of the problems being solved and it en- 
ables the consumers to determine when a problem has been rectified. The filtering pro- 

5 grams 220-226 are preferably implemented in the same high level programming language 
as the distributor. The programs may include simple true or false tests or they may in- 
clude more complex tests that cannot be implemented using Boolean or SQL statements. 
The filtering programs 220-226 from each consumer are stored in the distributor's regis- 
tration list and they are used by the distributor to determine which consumers should re- 

10 ceive each incoming message. 

Specifically in the preferred embodiment of the invention, the distributor 208 
compiles each program 220-226 sent from each consumer 210-216 when the consumer 
registers with the distributor/The filtering programs are preferably compiled in the same 
native language as the distributor's software application. Thereafter, the distributor 208 
is dynamically loads the compiled filtering programs 220-226 prior to executing the filter- 
ing queries. Since the distributor does not have to interpret the filtering programs upon 
receiving each incoming message, it executes the message queries faster than distributors 
that execute Boolean and/or SQL statements. 

Figs. 3 is a schematic block diagram depicting the format of a message 300 that is 
20 generated by a producer 202-206 and sent to the distributor 208 for transmission to the 
appropriate consumer(s) 210-216. The message includes a message type 302 identifying 
the type of message and arguments 304-306 whose values are tested to determine whether 
a message should be sent to a consumer. Messages from different producers contain dif- 
ferent arguments. For example, a message about whether data throughput has exceeded 
25 its threshold would contain the current data throughput value but not a status value, 

whereas, a message about a router's status would contain the status value but it may not 
contain the data throughput value. 
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Prior distributors either need to know all of the different message formats that are - 
available for processing in order to examine them or they may execute complex, time- 
consuming algorithms to determine if a message contains the argument(s) the consumer 
is interested in. TJhe algorithms then extract the values of those arguments and examine 

5 _ the values. If new message formats with new arguments are introduced, the distributors . 
may have to be updated in order to process the new arguments. In the present invention 
filters are created at run time. Therefore, new message formats with new arguments can 
be introduced at anytime without updating the distributor. Additionally, higher level pro- 
gramming languages enable definitions of data structures that match the new message 

10 formats and they enable casting of the new messages to these new data structures. Thus, 
the filters do not have to examine the messages if the desired arguments actuary exist in 
the messages. The filters in the current invention are therefore a lot faster than algorithms 
used in prior distributors. 

Figs. 4-A to 4-C illustrate filtering expressions executed on the message of Fig. 3. 

is The filtering expressions in Figs. 4-A to 4-C are implemented in accordance with a Boo- 
lean statement, a SQL statement and a filtering program respectively. Boolean expres- 
sions are useful for comparing values or performing true and false tests. Fig. 4-A is an 
example of a Boolean statement that compares two values. The first part of the Boolean 
expression tests to see if "datal" in the message is equal to 42 and the second part tests to 

20 see if a secondary argument "data2" is equal to 46. If both expressions in the Boolean 
statement are true, the distributor 208 transmits the message to the consumer 210-216 that 
registered the statement. 

Fig 4-B is an example of a SQL statement. SQL statements are also useful for 
comparing values and performing other filtering tests. However, SQL statements cannot 
25 perform complex filtering tests on statements that are analyzed individually and that are 
not stored in a database. The first expression in the illustrative SQL statement tests 
whether the value of datal is equal to 42 and the second expression tests to see if the 
value of data2 is less than or equal to 46, If both expressions in the SQL statement are 
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true, the distributor 208 transmits the message to the consumer 210-216 that registered 
the statement. 

Fig. 4-C is an example of a filtering program. Filtering programs can perform 
complex queries on individual messages or on groups of messages. The example in Fig. 
.. s 4-C transmits only the 5th message where the value in datal is equal- to 42. 

The foregoing description has been directed to specific embodiments of this in- 
vention. It will be apparent, however, that other variations and modifications may be 
made to the described embodiments, with the attainment of some or all of their advan- 
tages. Therefore, it is the object of the appended claims to cover all such variations and 

* 

io modifications as come within the true spirit and scope of the invention. 
What is claimed is: 
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